Security-57740.31.2.tar.gz

[apple/security.git] / SecurityTests / clxutils / dotMacTool / README

dotMacTool notes May 4 2004

-- for now you need this in /etc/hosts:

# for INT2
17.207.20.182 int-cert certmgmt.mac.com certinfo.mac.com

# or, for INT1
17.207.43.109 qa-cert certmgmt.mac.com certinfo.mac.com

-- A good way to run tcpdump to show HTTP traffic on port 2150:

   tcpdump -i en0 -s 0 -A -q tcp port 2150

-- renew cert for existing account doug1 with password 123456:

tower.local:dotMacTool> dotMacTool g -g -u doug1 -Z 123456 -k foobar -r -o /tmp/c2.pem
<<<snip away debug logging>>>
...cert acquisition complete
...2496 bytes of Cert written to /tmp/c2.pem

==============================================

-- demo queued response and retrieval
   -- set FORCE_SUCCESS_QUEUED to 1 in dotMacTpRpcGlue.cpp, this turns a full
      success RPC into a successQueued RPC
	  
tower.local:dotMacTool> dotMacTool g -g -u doug1 -Z 123456 -k foobar -r -o /tmp/refid.pem
<<<snip away debug logging>>>
...Forcing REQ_QUEUED status
...cert acquisition complete
...105 bytes of Cert written to /tmp/refid.pem

...then lookup....

tower.local:dotMacTool> dotMacTool l -f /tmp/refid.pem -o /tmp/cert.pem
<<<snip away debug logging>>>
...cert retrieval complete
...10010 bytes of cert data written to /tmp/cert.pem

==============================================

TO DO
-----

-- DOT_MAC_LOOKUP_ID_PATH* consts in dotMacTp.h will change to allow loopkup of one 
   specific cert
-- DOT_MAC_SIGN_HOST_NAME and DOT_MAC_LOOKUP_HOST will change to avoid the port 2150

..........

Aug 10 testing

-- use INT1 environment